Hetzner Cloud Networking
Networks
Create a Network
hcloud network create --name <name> --ip-range <cidr>
| Flag |
Description |
--name |
Network name (required) |
--ip-range |
Network IP range in CIDR notation (required) |
--label |
User-defined labels as key=value (repeatable) |
--enable-protection |
Enable protection: delete |
--expose-routes-to-vswitch |
Expose routes to connected vSwitch |
-o, --output |
Output options: json|yaml |
List Networks
hcloud network list
Columns: id, name, ip_range, servers, age, created, labels, protection, expose_routes_to_v_switch
| Flag |
Description |
-l, --selector |
Filter by label selector |
-s, --sort |
Sort results |
-o, --output |
Output options: noheader|columns=...|json|yaml |
Describe a Network
hcloud network describe <network>
| Flag |
Description |
-o, --output |
Output options: json|yaml|format |
Delete Networks
hcloud network delete <network>...
Accepts one or more networks by name or ID.
Update a Network
hcloud network update --name <name> <network>
Add a Subnet
hcloud network add-subnet --network-zone <zone> --type <cloud|server|vswitch> <network>
| Flag |
Description |
--network-zone |
Name of network zone (required) |
--type |
Subnet type: cloud, server, or vswitch (required) |
--ip-range |
Range to allocate IPs from |
--vswitch-id |
ID of the vSwitch (required when type is vswitch) |
Remove a Subnet
hcloud network remove-subnet --ip-range <cidr> <network>
| Flag |
Description |
--ip-range |
IP range of the subnet to remove (required) |
Add a Route
hcloud network add-route --destination <cidr> --gateway <ip> <network>
| Flag |
Description |
--destination |
Destination network or host in CIDR notation (required) |
--gateway |
Gateway IP address (required) |
Remove a Route
hcloud network remove-route --destination <cidr> --gateway <ip> <network>
| Flag |
Description |
--destination |
Destination network or host in CIDR notation (required) |
--gateway |
Gateway IP address (required) |
Change IP Range
hcloud network change-ip-range --ip-range <cidr> <network>
The new range must contain the existing range. You can only expand, not shrink.
Expose Routes to vSwitch
hcloud network expose-routes-to-vswitch [--disable] <network>
Enables exposing routes to the connected vSwitch. Use --disable to remove exposed routes.
Labels and Protection
hcloud network add-label [--overwrite] <network> <key=value>...
hcloud network remove-label <network> (--all | <key>...)
hcloud network enable-protection <network> delete
hcloud network disable-protection <network> delete
Firewalls
Create a Firewall
hcloud firewall create --name <name>
| Flag |
Description |
--name |
Firewall name (required) |
--rules-file |
JSON file containing rules (use - for stdin); structure must match the API |
--label |
User-defined labels as key=value (repeatable) |
-o, --output |
Output options: json|yaml |
List Firewalls
hcloud firewall list
Columns: id, name, rules_count, applied_to_count, age, created, labels
| Flag |
Description |
-l, --selector |
Filter by label selector |
-s, --sort |
Sort results |
-o, --output |
Output options: noheader|columns=...|json|yaml |
Describe a Firewall
hcloud firewall describe <firewall>
| Flag |
Description |
-o, --output |
Output options: json|yaml|format |
Delete Firewalls
hcloud firewall delete <firewall>...
Accepts one or more firewalls by name or ID.
Update a Firewall
hcloud firewall update --name <name> <firewall>
Add a Rule
hcloud firewall add-rule [options] (--direction in --source-ips <ips> | --direction out --destination-ips <ips>) (--protocol <tcp|udp> --port <port> | --protocol <icmp|esp|gre>) <firewall>
| Flag |
Description |
--direction |
Direction: in or out (required) |
--protocol |
Protocol: tcp, udp, icmp, esp, or gre (required) |
--port |
Port or port range (e.g. 80 or 80-85); only for tcp/udp |
--source-ips |
Source IPs in CIDR notation (required when direction is in) |
--destination-ips |
Destination IPs in CIDR notation (required when direction is out) |
--description |
Description of the rule |
Delete a Rule
hcloud firewall delete-rule [options] (--direction in --source-ips <ips> | --direction out --destination-ips <ips>) (--protocol <tcp|udp> --port <port> | --protocol <icmp|esp|gre>) <firewall>
Uses the same flags as add-rule to identify and remove the matching rule.
Replace All Rules
hcloud firewall replace-rules --rules-file <file> <firewall>
Replaces all rules from a JSON file. Use - to read from stdin. The JSON structure must match the Hetzner Cloud API format.
Apply Firewall to a Resource
hcloud firewall apply-to-resource --type <server|label_selector> <firewall>
| Flag |
Description |
--type |
Resource type: server or label_selector (required) |
--server |
Server name or ID (required when type is server) |
-l, --label-selector |
Label selector (required when type is label_selector) |
Remove Firewall from a Resource
hcloud firewall remove-from-resource --type <server|label_selector> <firewall>
Uses the same flags as apply-to-resource.
Labels
hcloud firewall add-label [--overwrite] <firewall> <key=value>...
hcloud firewall remove-label <firewall> (--all | <key>...)
Floating IPs
Create a Floating IP
hcloud floating-ip create --type <ipv4|ipv6> (--home-location <location> | --server <server>)
| Flag |
Description |
--type |
IP type: ipv4 or ipv6 (required) |
--home-location |
Home location (mutually exclusive with --server) |
--server |
Server to assign the IP to (mutually exclusive with --home-location) |
--name |
Floating IP name |
--description |
Description |
--label |
User-defined labels as key=value (repeatable) |
--enable-protection |
Enable protection: delete |
-o, --output |
Output options: json|yaml |
List Floating IPs
hcloud floating-ip list
Columns: id, name, type, ip, server, home, dns, description, age, created, labels, protection, blocked
| Flag |
Description |
-l, --selector |
Filter by label selector |
-s, --sort |
Sort results |
-o, --output |
Output options: noheader|columns=...|json|yaml |
Describe a Floating IP
hcloud floating-ip describe <floating-ip>
| Flag |
Description |
-o, --output |
Output options: json|yaml|format |
Delete Floating IPs
hcloud floating-ip delete <floating-ip>...
Accepts one or more floating IPs by name or ID.
Update a Floating IP
hcloud floating-ip update <floating-ip>
| Flag |
Description |
--name |
New name |
--description |
New description |
Assign a Floating IP
hcloud floating-ip assign <floating-ip> <server>
Unassign a Floating IP
hcloud floating-ip unassign <floating-ip>
Set Reverse DNS
hcloud floating-ip set-rdns [--ip <ip>] (--hostname <hostname> | --reset) <floating-ip>
| Flag |
Description |
-i, --ip |
IP address for which the reverse DNS entry should be set |
-r, --hostname |
Hostname to set as a reverse DNS PTR entry |
--reset |
Reset the reverse DNS entry to the default value |
Protection and Labels
hcloud floating-ip enable-protection <floating-ip> delete
hcloud floating-ip disable-protection <floating-ip> delete
hcloud floating-ip add-label [--overwrite] <floating-ip> <key=value>...
hcloud floating-ip remove-label <floating-ip> (--all | <key>...)
Primary IPs
Create a Primary IP
hcloud primary-ip create --type <ipv4|ipv6> --name <name>
| Flag |
Description |
--type |
IP type: ipv4 or ipv6 (required) |
--name |
Primary IP name (required) |
--location |
Location (ID or name) |
--assignee-id |
Assignee (usually a server) to assign the IP to |
--auto-delete |
Delete the IP when the assigned resource is deleted |
--label |
User-defined labels as key=value (repeatable) |
--enable-protection |
Enable protection: delete |
-o, --output |
Output options: json|yaml |
Note: The --datacenter flag is deprecated. Use --location or --assignee-id instead.
List Primary IPs
hcloud primary-ip list
Columns: id, name, type, ip, assignee, assignee_id, assignee_type, auto_delete, dns, age, created, labels, protection, blocked
| Flag |
Description |
-l, --selector |
Filter by label selector |
-s, --sort |
Sort results |
-o, --output |
Output options: noheader|columns=...|json|yaml |
Describe a Primary IP
hcloud primary-ip describe <primary-ip>
| Flag |
Description |
-o, --output |
Output options: json|yaml|format |
Delete Primary IPs
hcloud primary-ip delete <primary-ip>...
Accepts one or more primary IPs by name or ID.
Update a Primary IP
hcloud primary-ip update <primary-ip>
| Flag |
Description |
--name |
New name |
--auto-delete |
Delete the IP when the assigned resource is deleted |
Assign a Primary IP
hcloud primary-ip assign --server <server> <primary-ip>
Unassign a Primary IP
hcloud primary-ip unassign <primary-ip>
Set Reverse DNS
hcloud primary-ip set-rdns [--ip <ip>] (--hostname <hostname> | --reset) <primary-ip>
| Flag |
Description |
-i, --ip |
IP address for which the reverse DNS entry should be set |
-r, --hostname |
Hostname to set as a reverse DNS PTR entry |
--reset |
Reset the reverse DNS entry to the default value |
Protection and Labels
hcloud primary-ip enable-protection <primary-ip> delete
hcloud primary-ip disable-protection <primary-ip> delete
hcloud primary-ip add-label [--overwrite] <primary-ip> <key=value>...
hcloud primary-ip remove-label <primary-ip> (--all | <key>...)
Load Balancers
Create a Load Balancer
hcloud load-balancer create --name <name> --type <type>
| Flag |
Description |
--name |
Load balancer name (required) |
--type |
Load balancer type ID or name (required) |
--algorithm-type |
Algorithm: round_robin or least_connections |
--location |
Location (ID or name) |
--network |
Network (ID or name) to attach on creation |
--network-zone |
Network zone |
--label |
User-defined labels as key=value (repeatable) |
--enable-protection |
Enable protection: delete |
-o, --output |
Output options: json|yaml |
List Load Balancers
hcloud load-balancer list
Columns: id, name, type, ipv4, ipv6, location, network_zone, health, age, created, labels, protection
| Flag |
Description |
-l, --selector |
Filter by label selector |
-s, --sort |
Sort results |
-o, --output |
Output options: noheader|columns=...|json|yaml |
Describe a Load Balancer
hcloud load-balancer describe <load-balancer>
| Flag |
Description |
--expand-targets |
Expand all label_selector targets |
-o, --output |
Output options: json|yaml|format |
Delete Load Balancers
hcloud load-balancer delete <load-balancer>...
Accepts one or more load balancers by name or ID.
Update a Load Balancer
hcloud load-balancer update --name <name> <load-balancer>
Add a Service
hcloud load-balancer add-service [options] (--protocol http | --protocol tcp --listen-port <1-65535> --destination-port <1-65535> | --protocol https --http-certificates <ids>) <load-balancer>
| Flag |
Description |
--protocol |
Protocol: http, tcp, or https (required) |
--listen-port |
Listen port of the service |
--destination-port |
Destination port on targets |
--http-certificates |
IDs or names of certificates (for https) |
--http-redirect-http |
Redirect port 80 to port 443 |
--http-sticky-sessions |
Enable sticky sessions |
--http-cookie-name |
Sticky sessions cookie name |
--http-cookie-lifetime |
Sticky sessions cookie lifetime |
--proxy-protocol |
Enable proxy protocol |
Health check flags:
| Flag |
Default |
Description |
--health-check-protocol |
|
Health check protocol |
--health-check-port |
|
Health check port |
--health-check-interval |
15s |
Interval between health checks |
--health-check-timeout |
10s |
Timeout before marking unhealthy |
--health-check-retries |
3 |
Retries before marking as failed |
--health-check-http-domain |
|
Domain for HTTP health checks |
--health-check-http-path |
|
Path for HTTP health checks |
--health-check-http-response |
|
Expected response body |
--health-check-http-status-codes |
|
Expected status codes |
--health-check-http-tls |
|
Verify TLS certificate on health check |
Update a Service
hcloud load-balancer update-service --listen-port <port> <load-balancer>
Identifies the service by --listen-port and accepts all the same flags as add-service to modify properties.
Delete a Service
hcloud load-balancer delete-service --listen-port <port> <load-balancer>
Add a Target
hcloud load-balancer add-target [options] (--server <server> | --label-selector <selector> | --ip <ip>) <load-balancer>
| Flag |
Description |
--server |
Server name or ID |
--label-selector |
Label selector for server targets |
--ip |
IP address for IP targets |
--use-private-ip |
Connect to target via private network |
Remove a Target
hcloud load-balancer remove-target [options] <load-balancer>
| Flag |
Description |
--server |
Server name or ID |
--label-selector |
Label selector |
--ip |
IP address of an IP target |
Change Algorithm
hcloud load-balancer change-algorithm --algorithm-type <round_robin|least_connections> <load-balancer>
Change Type
hcloud load-balancer change-type <load-balancer> <load-balancer-type>
Attach to Network
hcloud load-balancer attach-to-network --network <network> <load-balancer>
| Flag |
Description |
-n, --network |
Network ID or name (required) |
--ip |
IP address to assign (auto-assigned if omitted) |
--ip-range |
Subnet IP range in CIDR notation (auto-assigned if omitted) |
Detach from Network
hcloud load-balancer detach-from-network --network <network> <load-balancer>
Enable Public Interface
hcloud load-balancer enable-public-interface <load-balancer>
Disable Public Interface
hcloud load-balancer disable-public-interface <load-balancer>
Set Reverse DNS
hcloud load-balancer set-rdns [--ip <ip>] (--hostname <hostname> | --reset) <load-balancer>
| Flag |
Description |
-i, --ip |
IP address for which the reverse DNS entry should be set |
-r, --hostname |
Hostname to set as a reverse DNS PTR entry |
--reset |
Reset the reverse DNS entry to the default value |
Protection and Labels
hcloud load-balancer enable-protection <load-balancer> delete
hcloud load-balancer disable-protection <load-balancer> delete
hcloud load-balancer add-label [--overwrite] <load-balancer> <key=value>...
hcloud load-balancer remove-label <load-balancer> (--all | <key>...)
Load Balancer Types
List Load Balancer Types
hcloud load-balancer-type list
Columns: id, name, description, max_connections, max_services, max_targets, max_assigned_certificates
| Flag |
Description |
-l, --selector |
Filter by label selector |
-s, --sort |
Sort results |
-o, --output |
Output options: noheader|columns=...|json|yaml |
Describe a Load Balancer Type
hcloud load-balancer-type describe <load-balancer-type>
| Flag |
Description |
-o, --output |
Output options: json|yaml|format |
